Digital rights management dongle

ABSTRACT

A dongle for digital rights management protection, in accordance with one embodiment of the present technology, includes a digital right management engine and an encryption/decryption engine. The digital rights management engine is adapted to port digital rights management rules of a source of content to digital rights management rules enforced by the digital rights management engine. The encryption/decryption engine is adapted to re-encrypting the source of content into a managed copy of the content, wherein the managed copy of the content is locked to the dongle.

BACKGROUND OF THE INVENTION

Computing devices have made significant contributions toward theadvancement of modern society and are utilized in a number ofapplications to achieve advantageous results. Numerous devices, such asTVs, DVD players, game consoles, computers and the like have facilitatedincreased consumption of content in most areas of entertainment,education, business and science. Computing devices have also made itfaster, easier and cheaper to access content of all types in digitalform. The convenience of having content more readily accessibletypically results in users accessing content more often and may alsoresult in users acquiring ever-increasing amounts of content.

However, computing devices also make it easier, faster and cheaper topirate digital media. Furthermore, unlike content on physical media suchas paper and media in analog format, digital media may be exactlyreproduced multiple times without degradation. To continue to makecontent more accessible and encourage greater use and consumption,protective schemes are employed against piracy of digital content whilemaintaining the accessibility of the content. Conventional protectiveschemes have included software based encryption and/or tamper-resistanthardware. The conventional protective schemes have also been specific toa particular platform. In addition, the conventional protective schemesare vulnerable to attack. For example, the software implementations canbe bypassed, the encryption keys have been found in the clear or evenhidden in the device's memory, and the like. Therefore, there is acontinuing need for improved digital rights management schemes.

SUMMARY OF THE INVENTION

Embodiments of the present invention are directed toward digital rightsmanagement protection techniques locked to an encryption/decryptiondongle. In one embodiment, a method of enforcing digital rightsmanagement includes receiving source encrypted content on an inputdevice (e.g., DVD drive) of a computing device. The source encryptedcontent is transferred from the computing device to a dongle. The dongletranslates a set of DRM rules associated with the source encryptedcontent to a set of rules associated with the dongle. The dongle alsore-encrypts the source encrypted content into a managed copy of thecontent locked to the dongle. The managed copy of the content may thenbe transferred from the dongle to the computing device for storagelocally on the computing device. The method may also includetransferring the managed copy from the computing device back to thedongle. The dongle re-encrypts the managed copy of the content into arendering copy of the content locked to a video card of the computingdevice. The rendering copy of the content may then be transferred fromthe dongle to the video card for rendering on a monitor.

In another embodiment, a method of enforcing digital rights managementincludes receiving source encrypted content on an input device (e.g.,DVD drive) of a computing device. The source encrypted content istransferred from the computing device to a dongle. The dongle translatesa set of DRM rules associated with the source encrypted content to a setof rules associated with the dongle. The dongle also re-encrypts thesource encrypted content into a rendering copy of the content locked toa video card of the computing device. The rendering copy of the contentmay then be transferred from the dongle to the video card for renderingon a monitor.

In yet another embodiment, a dongle is adapted to be communicativelycoupled to a personal computer, laptop computer, game console, homeentertainment system, hand-held gaming unit, digital video recorder,personal digital assistant (PDA), cell phone, portable audio player(e.g., MP3 players), server computer, client computer, minicomputer,mainframe computer, distributed computer system and the like. The dongleincludes a digital right management engine and an encryption/decryptionengine. The digital rights management engine is adapted to port digitalrights management rules associated with a source of content to digitalrights management rules enforced by the digital rights managementengine. The encryption/decryption engine is adapted to re-encrypting thesource encrypted content into a managed copy of the content.Accordingly, the managed copy of the content is locked to theencryption/decryption engine.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments of the present technology are illustrated by way of exampleand not by way of limitation, in the figures of the accompanyingdrawings and in which like reference numerals refer to similar elementsand in which:

FIG. 1 shows a block diagram of an exemplary computing device forimplementing embodiments of the present technology.

FIG. 2 shows a block diagram of a dongle, in accordance with oneembodiment of the present technology.

FIGS. 3, 4, 5 and 6 show a flow diagram of a method of digital rightsmanagement, in accordance with one embodiment of the present technology

DETAILED DESCRIPTION OF THE INVENTION

Reference will now be made in detail to the embodiments of the presenttechnology, examples of which are illustrated in the accompanyingdrawings. While the present technology will be described in conjunctionwith these embodiments, it will be understood that they are not intendedto limit the invention to these embodiments. On the contrary, theinvention is intended to cover alternatives, modifications andequivalents, which may be included within the scope of the invention asdefined by the appended claims. Furthermore, in the following detaileddescription of the present technology, numerous specific details are setforth in order to provide a thorough understanding of the presenttechnology. However, it is understood that the present technology may bepracticed without these specific details. In other instances, well-knownmethods, procedures, components, and circuits have not been described indetail as not to unnecessarily obscure aspects of the presenttechnology.

Referring to FIG. 1, an exemplary computing device 100 for implementingembodiments of the present technology is shown. The computing device 100may be a personal computer, laptop computer, game console, homeentertainment system, hand-held gaming unit, digital video recorder,personal digital assistant (PDA), cell phone, portable audio player(e.g., MP3 players), server computer, client computer, minicomputer,mainframe computer, distributed computer system or the like. Thecomputing device 100 includes one or more processors (e.g., CPU) 110,one or more computing device-readable media 115, 120 and one or moreinput/output (I/O) devices 125-150. The I/O devices 125-150 may includea video card 125 and/or graphics processing unit (GPU), a monitor 130, anetwork adapter (e.g., Ethernet card) 135, a keyboard 140, a pointingdevice 145, a CD drive, a game controller (e.g., joystick), a DVD drive150 and/or the like.

The computing device-readable media 115, 120 and 110 devices 125-150 maybe communicatively coupled to the processor 110 by a chip set 155 andone or more busses. The chipset 155 acts as a simple input/output hubfor communicating data and instructions between the processor 110, thecomputing device-readable media 115, 120, and I/O devices 125-150.

The computing device-readable media 115, 120 may include secondarymemory, such as a magnetic and/or optical storage, that provides fornon-volatile storage of computing device-executable instructions anddata for use by the computing device 100. For instance, a hard diskdrive 120 may store the operating system (OS), one or more applicationsand associated data. The computing device-readable media 115, 120 mayalso include primary memory, such as the system memory 115 and/orgraphics memory, which provides for volatile storage of computingdevice-executable instructions and data for use by the computing device100. For instance, the random access memory (RAM) 115 may temporarilystore a portion of the operating system, a portion of one or moreapplications and associated data that are currently used by the CPU 110,GPU and the like.

The computing device 100 may also include a dongle 160, which is asecure local re-encryption engine. The dongle 160 includes a signeddigital certificate verifying its security. The dongle 160 may beremovably coupleable (e.g., external peripheral device) to the computingdevice 100. For instance, the dongle 160 may be a small form factorperipheral that can be readily coupled to and uncoupled from a universalserial (USB) port, a FireWire port, or the like. The use of USB orFireWire advantageously provides power from the computing device 100 foroperation of the dongle 160. In another implementation, the dongle maybe integrally coupled to the computing device 100. For instance, thedongle 160 may be an internal peripheral device, or an integratedcircuit within the chipset 155.

Referring now to FIG. 2, a dongle, in accordance with one embodiment ofthe present technology, is shown. The dongle 160 includes an interfacecontroller 210, a digital rights management engine 220, anencryption/decryption engine 230 and dongle memory 240. The donglememory 240 is computing device-readable media and is not accessibleoutside of the dongle 160.

The interface controller 210 is adapted to receive source encryptedcontent from the computing device 100 and send a managed copy and orrendering copy to the computing device 100. The digital rightsmanagement (DRM) engine is adapted to port the DRM rules of the sourcecontent to the DRM rules enforced by the DRM engine so that the managedcopy of the content is locked to the encryption/decryption engine of thegiven dongle. The DRM engine 220 in combination with the interfacecontroller 210 may also be adapted to establish a secure communicationchannel. The establishing the secure communication channel may includesending and/or receiving authentication certificates, session keys orthe like. In one implementation, the interface may be a USB. In suchcase the interface controller 210 would have a standard applicationprogramming interface (API) for creating the secure communicationchannel that included exchanging certificates and negotiating sessionkeys. However, while the communication channel is maintained viasoftware, neither the keys nor the content is available in the clear.

The encryption/decryption engine is adapted to decrypt the sourceencrypted content and re-encrypt the content into the managed copy. Thedongle memory 240 is adapted to store one or more encryption keys,authentication certificates and the like for use by the digital rightsmanagement engine 220 and/or the encryption/decryption engine 230. Thedongle memory 240 is also adapted to store the source content, themanaged copy of the content and any content in the clear duringprocessing by the encryption/decryption engine 230.

Operation of the computing device 100 in combination with the dongle 160will be further described herein with reference to FIGS. 3, 4, 5 and 6.FIGS. 3, 4, 5 and 6 show a method of digital rights management, inaccordance with one embodiment of the present technology. Referring nowto FIG. 3, the method begins with receiving content 165 by a computingdevice 100, at 305. As shown in FIG. 1, the content may be received onthe DVD drive 150 of the computing device 100. However, the exampleillustrated in FIG. 1 is not intended to limit the device or peripheralthat the content is received on or the source of the content. Thecontent 165 may be downloaded (e.g., an electronic file transfer),received on a computing device-readable media (e.g., DVD, CD or thelike) or by any other similar means. The content may be music, movies,pictures, documents, data, software and/or the like. When the contentincludes source encrypted content 165, the content 165 is sent to thedongle 160, at 310. The source encrypted content 165 may also include orhave associated with it a set of DRM rules that govern the use of thecontent, and metadata describing the content. The metadata is also usedto manipulate the content. For example, the metadata may specify thestart of chapters and/or section in a movie and can be used to startplayback at a particular chapter or section.

At 315, the dongle 160 receives the source encrypted content 165 fromthe computing device 100. For instance, a DVD may be inserted into theDVD drive 150 of the computer 100. The source encrypted content 165 istransferred from the DVD to the dongle 160. In one implementation, thesource encrypted content 165 is transferred across a securecommunication channel negotiated between the input device (e.g., DVDdrive 150) and the dongle 160.

The DRM engine 220 of the dongle 160 translates the DRM rules associatedwith the source encrypted content 165 into DRM rules associated with thedongle 160, at 320. The DRM rules associated with the dongle 160 enforcethe protection policies specified in the DRM rules associated with thesource encrypted content 165. The encryption/decryption engine 230re-encrypts the source encrypted content into a managed copy of thecontent, at 325. In particular, the encryption/decryption engine 230decrypts the source encrypted content into a clear copy of the content.The encryption/decryption engine 230 then encrypts the clear copy of thecontent into a dangle encrypted content, which is also referred hereinto as the managed copy. The dongle memory 240 may be utilized to storethe source encrypted content, the content in the clear betweendecryption and encryption and/or the managed copy of the content.However, the dongle memory 240 is not accessible from outside the dongle160 and therefore the content is not available in the clear outside thedongle 160.

Referring now to FIG. 4, the managed copy is sent by the dongle 160 tothe computing device 100, at 330. The managed copy may include or haveassociated with it the dongle DRM rules for protecting the given managedcopy of the content and the metadata describing the content. At 335, themanaged copy is received by a controller of the computingdevice-readable media 120 from the dongle 160. At 340, the managed copy170, as illustrated in FIG. 1, may be stored in one or more computerreadable media 115, 120 of the computing device 100. For instance, themanaged copy 170 may be stored on the hard disk drive 120 of thecomputing device 100. In one implementation, the managed copy of thecontent 170 is transferred across a secure communication channelnegotiated between the dongle 160 and a computing device readable media115, 120 of the computing device 100.

Accordingly, the source encrypted content is locked to the source mediaand the managed copy is locked to the dongle 160. The managed copy ofthe content 170 can be stored locally on the computing device 100.However, the managed copy of the content is protected because it canonly be decrypted by the dongle 160. The metadata is maintained in theclear and can be used to manipulate the content, whether the content issource encrypted content, a managed copy of the content, or a renderingcopy of the content.

The method may also include the computing device 100 sending the managedcopy of the content 170 to the dongle 160, at 345. At 350, the dongle160 receives the managed copy 170 from the computing device. Forinstance, the managed copy of the content 170 stored locally on the harddisk drive 120 may be transferred back to the dongle 160. In oneimplementation, the managed copy 170 is transferred across a securecommunication channel negotiated between the computing device 100 andthe dongle 160.

Referring now to FIG. 5, the DRM engine 220 enforces the protectionpolicies specified in the DRM rules associated with the managed copy170, at 355. At 360, the encryption/decryption engine 230 re-encryptsthe managed copy of the content into a rendering copy of the content inaccordance with enforcement of the DRM rules. In particular, theencryption/decryption engine 230 decrypts the managed copy, which is thedongle encrypted copy of the content, into a clear copy of the content.The encryption/decryption engine 230 then encrypts the clear copy of thecontent into the rendering encrypted content. For instance, theencryption/decryption engine 230 may encrypt the clear copy of thecontent using the public key of the video card 125, GPU or the like. Thedongle memory 240 may be utilized to store the managed copy, the clearcopy and/or the rendering copy of the content between decryption andencryption. However, as previously noted, the dongle memory 240 is notaccessible from outside the dongle 160 and therefore the content is notavailable in the clear outside the dongle 160. Accordingly, therendering copy of the content is locked to the video card 125, GPU orthe like of the computing device 100.

At 365, the rendering copy is sent by the dongle 160 to the computingdevice 100. At 370, the rendering copy is received by the computingdevice 100 from the dongle 160. At 375, the rendering copy may be usedby the video card 125, GPU or the like to render the content on themonitor 130 or the like, including decrypting the rendering content. Inone implementation, the rendering copy of the content is transferredacross a secure communication channel negotiated between the dongle 160and the video card 125, GPU or the like of the computing device 100.

Referring again to FIG. 3, the method may further include receivingcontent 165 by the computing device 100, at 305. When the contentincludes source encrypted content 165, the content 165 is sent to thedongle 160, at 310. At 315, the dongle 160 receives the source encryptedcontent 165 from the computing device 100. The DRM engine 230 of thedongle 160 translates the DRM rules associated with the source encryptedcontent 165 into DRM rules associated with the dongle 160, at 320.Referring now to FIG. 6, the encryption/decryption engine 230re-encrypts the source encrypted content into a rendering copy of thecontent, at 380. In particular, the encryption/decryption engine 230decrypts the source encrypted content into a clear copy of the content.The encryption/decryption engine 230 then encrypts the clear copy of thecontent into a rendering encrypted copy of the content. For instance,the encryption/decryption engine 230 may encrypt the clear copy of thecontent using the public key of the video card 125, GPU or the like. Thedongle memory 240 may be utilized to store the source encrypted content,the content in the clear between decryption and encryption, and therendering copy of the content. However, the dongle memory 240 is notaccessible from outside the dongle 160 and therefore the content is notavailable in the clear outside the dongle 160.

At 385, the rendering copy is sent by the dongle 160 to the computingdevice 100. At 390, the rendering copy is received by the computingdevice 100 from the dongle 160. At 395, the rendering copy may be usedby the video card 125, GPU or the like to render the content on themonitor 130 or the like, perhaps sending the rendered content to themonitor over a secure link such as HDMI. In one implementation, therendering copy of the content is transferred across a securecommunication channel negotiated between the dongle 160 and the videocard 125, GPU or the like.

Accordingly, the dongle advantageously encrypts content for storagelocal to a computing device as a managed copy and/or for rendering bythe computing device. Only the encryption/decryption dongle can decryptthe managed copy. In addition, digital rights management (DRM)protection utilizing the encryption/decryption dongle is operatingsystem (OS) independent, and therefore can advantageously be applied onOpen Source platforms, Linux platforms, MAC-OS platforms, Windows/Vistaplatforms and the like. In addition, the content is locked to the donglerather than the CPU, hard disk drive, motherboard or the like.Accordingly, if the CPU, hard disk drive, motherboard or the like isreplaced (e.g., upgraded), the content can still be available via thedongle

The foregoing descriptions of specific embodiments of the presenttechnology have been presented for purposes of illustration anddescription. They are not intended to be exhaustive or to limit theinvention to the precise forms disclosed, and obviously manymodifications and variations are possible in light of the aboveteaching. The embodiments were chosen and described in order to bestexplain the principles of the present technology and its practicalapplication, to thereby enable others skilled in the art to best utilizethe present technology and various embodiments with variousmodifications as are suited to the particular use contemplated. It isintended that the scope of the invention be defined by the Claimsappended hereto and their equivalents.

1. A method of digital rights management comprising: receiving sourceencrypted content at a computing device; transferring the sourceencrypted content from the computing device to a dongle; translating aset of digital rights management rules associated with the sourceencrypted content to a set of digital rights management rules associatedwith the dongle; re-encrypting the source encrypted content into amanaged copy of the content locked to the dongle; transferring themanaged copy of the content from the dongle to the computing device; andstoring the managed copy of the content on one or more computingdevice-readable media of the computing device.
 2. The method accordingto claim 1, wherein the source encrypted content is locked to a sourceof the content.
 3. The method according to claim 1, wherein the sourceencrypted content is transferred from the computing device to the dongleacross a secure communication channel negotiated between the dongle andan input device that the source content was received on by the computingdevice.
 4. The method according to claim 1, wherein re-encrypting thesource encrypted content into the managed copy of the content locked tothe dongle comprises: decrypting the source encrypted content into aclear copy of the content not accessible from outside of the dongle; andencrypting the clear copy of the content into a dongle encryptedcontent.
 5. The method according to claim 1, wherein the managed copy ofthe content is transferred from the dongle to the computing deviceacross a secure communication channel negotiated between the dongle anda controller of the computing device-readable media that the managedcopy is stored on.
 6. The method according to claim 1, furthercomprising: transferring the managed copy from the computing device tothe dongle; re-encrypting the managed copy of the content into arendering copy of the content locked to a video card of the computingdevice; transferring the rendering copy of the content from the dongleto the video card; and rendering the content on a monitor of thecomputing device from the rendering copy.
 7. The method according toclaim 6, wherein the managed copy of the content is transferred from thecomputing device readable media of the computing device across a securecommunication channel negotiated between the dongle and a controller ofthe computing device-readable media.
 8. The method according to claim 6,wherein the rendering copy of the content is transferred from the dongleto the video card across a secure communication channel negotiatedbetween the dongle and the video card.
 9. The method according to claim1, wherein the computing device comprises a computer.
 10. The methodaccording to claim 1, wherein the computing device comprises a gameconsole.
 11. The method according to claim 1, wherein the computingdevice comprises a digital video recorder.
 12. The method according toclaim 1, wherein the computing device comprises a home entertainmentsystem.
 13. A method of digital rights management comprising: receivingsource encrypted content at a computing device; transferring the sourceencrypted content from the computing device to a dongle; translating aset of digital rights management rules associated with the sourceencrypted content to a set of digital rights management rules associatedwith the dongle; re-encrypting the source encrypted content into arendering copy of the content locked to a video card of the computingdevice; transferring the rendering copy of the content from the dongleto the video card; and rendering the content on a monitor of thecomputing device from the rendering copy.
 14. The method according toclaim 13, wherein the source encrypted content is transferred from thecomputing device to the dongle across a secure communication channelnegotiated between the dongle and an input device that the sourcecontent was received on by the computing device.
 15. The methodaccording to claim 13, wherein re-encrypting the source encryptedcontent into the rendering copy of the content locked to the video cardcomprises: decrypting the source encrypted content into a clear copy ofthe content not accessible from outside of the dongle; and encryptingthe clear copy of the content using an encryption key of the video card.16. The method according to claim 13, wherein the rendering copy of thecontent is transferred from the dongle to the video card across a securecommunication channel negotiated between the dongle and the video card.17. A dongle comprising: a digital rights management engine for portingdigital rights management rules of a source of content to digital rightsmanagement rules enforced by the digital rights management engine sothat a managed copy of the content is locked to an encryption/decryptionengine; and the encryption/decryption engine for re-encrypting thesource of content into the managed copy of the content.
 18. The dongleof claim 17, further comprising an interface controller for receivingthe source of content from a computing device and sending the managedcopy of the content to the computing device or another computing device.19. The dongle of claim 18, further comprising the interface controllerand the digital rights management engine for establishing a securecommunication channel between the dongle and the one or more computingdevices, wherein establishing the secure communication channel includessending an authentication certificate of the dongle.
 20. The dongle ofclaim 19, further comprising a computing device readable media notaccessible outside the dongle for storing the content duringre-encrypting the source of content into the managed copy of the contentand for storing the authentication certificate of the dongle.